#       $DragonFly: src/etc/pf.conf,v 1.2 2005/12/13 08:38:55 swildner Exp $
#
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
# Macros: define common values, so they can be referenced and changed easily.

int_if=sk0
ext_if=sk1
tcp_opts="flags S/SA modulate state"
table <intnet> {160.114.118.128/26, 160.114.118.192/27}
table <NotUsed> {}
table <Banned> {}
table <Switches> {160.114.118.205, 160.114.118.206, 160.114.118.207}

# Options: tune the behavior of pf, default values are given.
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 30000, frags 15000 }
set loginterface $ext_if
set optimization conservative
set block-policy return
set require-order yes
set fingerprints "/etc/pf.os"
scrub all no-df random-id

# ftp-proxy S01E01
rdr on $int_if inet proto tcp from <intnet> to any port ftp -> ($int_if) port 8021

block in log all
block out log all

block out quick on $ext_if from <Banned> to any
block in quick on $ext_if from any to <Banned>


# ftp-proxy S01E02
pass out quick on $ext_if route-to ( lo0 127.0.0.1 ) proto tcp from <intnet> to ($int_if) port 8021 allow-opts
#any port 21 keep state
pass in quick on $ext_if inet proto tcp from port 20 to ($int_if) user proxy keep state

pass out quick on $ext_if proto tcp from <intnet> to any keep state allow-opts
pass out quick on $ext_if proto udp from <intnet> to any keep state allow-opts

pass in quick on $ext_if proto tcp from any to <intnet> port 22 keep state

pass in quick on $ext_if from any to <Switches> keep state

pass in quick on $ext_if proto tcp from any to <intnet> port {4662,4565,5555,6789,16881:16891,25489,26314} keep state
pass in quick on $ext_if proto udp from any to <intnet> port {4672,5555,25506,26314} keep state

#running ftp servers is allowed, but reachable only from the campus subnet :)
pass in quick on $ext_if proto tcp from 160.114.118.0/24 to <intnet> port 21 keep state

pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 0 code 0 keep state
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 8 code 0 keep state
pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 8 code 0 keep state
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 0 code 0 keep state

pass quick on {$int_if,lo0,bridge0} all